CVE-2024-0220 B&R products use insufficient communication encryption
A network attacker can exploit insufficient encryption to execute arbitrary code or sniff sensitive data in B&R industrial automation products.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-0220?
CVE-2024-0220 is a high-severity vulnerability in B&R Industrial Automation Automation Studio, published on 22 Feb 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A network-based attacker could exploit the vulnerability to execute arbitrary code on the products or sniff sensitive data.
Which versions are affected by CVE-2024-0220?
It affects 2 products.
Products include Br-Automation Automation Studio, Br-Automation Technology Guarding.
How do I fix CVE-2024-0220?
No fix has been published for CVE-2024-0220 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-0220 being exploited?
There is no known exploitation of CVE-2024-0220 in the wild and no public exploit code.
Other vulnerabilities in B&R Industrial Automation Automation Studio
- CVE-2021-22282 RCE in B&R Automation Studio with crafted project files
- CVE-2020-24681 Automation Studio and PVI Multiple incorrect permission assignments for services
- CVE-2019-19100 Privilege escalation via B&R Automation Studio upgrade service
- CVE-2021-22280 DLL Hijacking Vulnerability in Automation Studio
- CVE-2019-19101 Incomplete communication encryption and validation in B&R Automation Studio upgrade service
Sources
Also known as GHSA-j3c9-h64h-gwp9.